Background technology
Department of computer science's for example specialized equipment of ATM (Automatic Teller Machine) (ATM) of unifying constantly provides protecting the visit at the interface that avoids unauthorized use.Security on the common this user interface is provided by password or " PIN (Personal Identification Number) " PIN, described password or " PIN (Personal Identification Number) " PIN must be at the individuality of access interface (perhaps, be another machine in some cases) further visit before, offer user interface by input equipment.
By " weak " password or token (token), for example, the safety grades that password or PIN provide is relevant with any degree with its length usually.But same factor has also determined the difficulty of an individual memory token.Equally, the quantity of possible token element values for example, makes simple numeral add the letter bigger security that improves that becomes with respect to numeral usually, and still, the increase of input set size is subject to usually in overall possible values space and uses general word or numeral.
When can be when the user provides " prompting " that encouragement collects token once more, this prompting have also produced potential security breaches, because token can be found by inferring when providing when prompting.Other system comprises the secondary password that has some concrete implications for the token owner, and it can be used in the announcement actual token.For example, the interface can use mother's user birth name or " animal of liking " etc. as secondary password, is used for the basic access token of protection when the user forgets.
Proposed two-dimensional textual or graphical hint systems, be used to satisfy the system that token is imported to utilizing the icon arrangement at random that to select according to the order of sequence or must arranging with the special icon that certain pattern is selected from for example system with the form actual displayed password of " hide word " puzzle.The advantage of all said system is that they can not only be broken through by the machine input that repeats easily.
But above-mentioned all systems can finally disclose their basic token by people's observation, especially when the hiding mechanism of basic token is known priori.For example, be to arrange if known token is hidden mechanism with the special icon that certain pattern is selected, the observer can ignore actual icons and only pay close attention to pattern so.
Token system with improvement " intensity " can rely on the less collection of element input value, can use more long-life password and/or can stride the use of a plurality of systems, and not have compromise to be the same risk than weak passwurd.
Therefore, be desirable to provide a kind of method and system, be used for showing hiding token in prompting, make and can not find token easily by observing token input pattern and value, permission simultaneously uses simple algorithm to create this token.
Summary of the invention
Hiding token in prompting shows makes and can not find that easily the above-mentioned target of token realizes in a kind of method and system by the observation that token is imported.
Described method and system shows that the prompting that comprises a plurality of elements shows that wherein, each element has value and position, and it can be digital array that described prompting shows.Described method and system receives the user input sequence corresponding with the selected pattern sequence of display element in conjunction with the algorithm that utilizes one or more operational symbols to carry out one or more computings on pattern sequence.
Described method and system compares with token by computational token from prompting shows and with user's input, and whether the checking user knows suitable pattern and algorithm.To one or more system resources conduct interviews or to which visit of one or more resources of system by system's control, decide by token and the coupling that the user imports.
The operational symbol that adopts from the pattern computational token can be mathematics (comprising logic) operational symbol or relational operator.Can get rid of one or more pattern elements from token computation, it can decide according to relational calculus or by ignoring one of them pattern element regularly.
Described method can realize or realize in special-purpose terminal with the browser of carrying out in the general-purpose computing system in general-purpose computing system.Described method also can be carried out calculation of coding machine program product at the programmed instruction to the step that is used to carry out described method and be realized.
According to an aspect of the present invention, provide a kind of method that is used to protect the resource that will use by the user, comprising:
Generate prompting and show that described prompting shows and is made up of the element of arranging in array;
In the array of selected array element, provide predetermined pattern;
Each element of predetermined pattern has unique position feature in described array;
At least one predetermined pattern element has digital value;
Show that to described user described prompting shows;
The described unit that makes the described predetermined pattern element that described user shows according to the prompting of described generation is computational token usually;
During calculating described token, make described user carry out at least one computing to described at least one described digital value that falls into the described element of described predetermined pattern, make this token comprise the digital value that at least one is hidden, this digital value of hiding is inequality with the digital value of described at least one described element of carrying out the nonidentity computing thereon;
Make described user token is input to the user interface of Verification System;
Receive described token from described user;
Compare at least one hiding digital value of the token that is received and at least one corresponding digital value of the corresponding token of this Verification System generation; And
Optionally provide visit according to the result of described comparison to described resource.
According to an aspect of the present invention, provide a kind of method of input of the security token that is used to receive resources conseravtion, comprising:
The prompting that generation has at least one quasi-random character shows that described demonstration is made up of the element that each all has value and unique position feature;
The value of the predetermined pattern element that shows according to the prompting of described generation and at least one is fallen at least one computing that the described element of described pattern carries out come computational token;
Show that to the user described prompting shows;
Receive input from described user;
The input of more described token and described reception; And
Optionally provide visit according to described comparative result to resource.
According to a second aspect of the invention, provide a kind of computer system, comprising: storer is used for stored program instruction and data; Processor is couple to described storer and is used to carry out described programmed instruction; Visual display unit is couple to described processor and is used for the output of explicit user interface; And input equipment, be couple to described processor and be used to provide the user interface input; Wherein, the described programmed instruction in the described multi-purpose computer comprises that programmed instruction is used for:
The prompting that generation has at least one quasi-random character shows that described demonstration is made up of the element that each all has value and unique position feature;
The value of the predetermined pattern element that shows according to the prompting of described generation and at least one is fallen at least one computing that the described element of described pattern carries out come computational token;
Show that to the user described prompting shows;
Receive input from described user;
The input of more described token and described reception; And
Optionally provide visit according to described comparative result to resource.
By in conjunction with accompanying drawing hereinafter the preferred embodiments of the present invention more specifically being described, above-mentioned and other target, characteristics and advantage of the present invention will become more obvious.
Embodiment
The present invention utilizes the method that realizes by execution of program instructions, to providing improved security by token or password input reference system.This technology is applicable in computer system or for example substitutes conventional password and PIN input in the special-purpose terminal of ATM.In computer system, the present invention can adopt in the operating system of general-purpose computing system, also can be embedded in the vertical application, perhaps provides by the web interface from downloaded, for example, by extend markup language (XML) program or java script program.The present invention is generally used for protecting the visit to resource, for example, and system login visit, the Financial Information on the ATM and the sign-on access of transaction capabilities or to sign-on access as other secure resources of application program or database.
Except the input of only accepting password or token as the conventional password system and selectively token is handled with itself and storing value are compared, the present invention also generates the random walk token effectively.The well-regulated processing of the set by the value hidden during the prompting of presenting to the user is shown generates token at random.Two compositions are arranged in processing: 1) pattern, the user selects element sequence by this pattern from prompting shows; And 2) algorithm utilizes in the one or more operational symbols from a plurality of computings that the value that produces to the small part element sequence is carried out to generate token.Prompting shows it can is generting element collection at random, and except the value of element and the scope of value must be suitable for using with the special algorithm that is adopted, and beyond pattern must be suitable for showing, described element set and pattern and algorithm do not have the relation of being scheduled to.Be generated as signal array or other demonstrations at random if prompting shows, so, can before discerning the user, generation show by user identification code or additive method.In case the user is identified, just sequence is selected in the appropriate location from prompting shows.Alternately, if before generating demonstration, discern the user, can at first generate and hiding sequence at the ad-hoc location that prompting shows so, described ad-hoc location is corresponding with the position in the above-mentioned pattern by utilizing another element set that generates at random to produce non-pattern position.
After element sequence is known, with algorithm application in the element sequence value to generate token, it can be the sequence of number, but also can be single number, for example summations of all numbers in the pattern.Any amount of value of operational symbol in can binding sequence, and in output sequence with its minimizing or in output sequence, it is enlarged.For example, the summation of three values of pattern element can represent that output sequence is reduced into 3: 1, still, be applied to two values in the sequence summation, multiply each other and " greater than " operational symbol can represent 2: 3 expansion of output sequence.The operational symbol of using can be (comprising logic) or the relation of mathematics, for example be applied to two numbers " greater than " or " less than " operational symbol.Usually, do not wish to reduce the number of elements in the output sequence, it provides the access token that is lower than certain grade, because short token easier " conjecture ".
The user simulate in the computing of pattern sequence selection and the storer based on the operational symbol algorithm, and according to selecting and token value is imported in mental arithmetic.Desired mental arithmetic sophistication levels can be adjusted by the total algorithm design of selecting suitable operational symbol and user to be provided with.For example, simple algorithm can be passed through the digital array artificial horizon, wherein token sequence value be in the straight line from left to right every pair of numeral than decimal.Very complicated algorithm can be significantly in conjunction with the random site of from value array, selecting in order, and utilize different mathematical operations that they are carried out combination to each value.
In addition, the user is not being changed under the situation of pattern and algorithm, the safety grades of system can change.Pattern can be clipped to reduce desired token length, changes the scope of the value of each element permission, and/or threaded list is defined as static array.In the above-mentioned technology each does not influence basic pattern and the algorithm of distributing to user security mechanism, but can make safety grades and complicacy adapt to the specific access instances of visit or to the visit of particular system.
The present invention also is provided for sharing the mechanism based on the visit information in past, and does not compromise on basic pattern and algorithm.If the owner of access pattern and algorithm knows particular hint and show, so, another people can be apprised of the result and import token and do not compromise on pattern/algorithm combination.
With reference now to accompanying drawing,, especially Fig. 1 has illustrated the networked system that can realize embodiments of the invention therein in block diagram.Described system 10 expression universal computing devices comprise: processor 16 and the storer 17 that is used to store the programmed instruction that data and processor 16 carry out that is couple to processor 16.Graphic alphanumeric display 13 is couple to system 10, and in fact can be integrated in the identical shell, and as common ATM and portable set, for example, notebook/flat computer or PDA(Personal Digital Assistant) are the same.According to embodiments of the invention, keyboard or keypad 14 also are couple to (or being integrated in) system 10 and are used to receive user's input.Alternately, can use positioning equipment, as illustrating hereinafter, utilize positioning equipment input to require the element of all input values all to present on the screen of graphic alphanumeric display 13, yet utilize keyboard or keypad, value need not present on screen.
Network connects 12 wireline interface 15A or the wave point 15B that can be implemented as processor 16, although and the present invention do not require that network connects, for example the equipment of ATM requires to be used for some latticed forms of financial accessing operation usually.
With reference now to Fig. 2,, user interface description is the screen 20 of graphic alphanumeric display 13 according to an embodiment of the invention.Show the prompting of forming by four 3x3 subarray 24A-D and show 23.Each subarray comprises a plurality of elements 26, and each element shows in 23 to have unique position in prompting.Each element 26 has also that possibility is unique also may not unique value.In illustrative example, value is the numerical value in the numeral of each element 26 surface demonstration.But, the invention is not restricted to numeral, be worth also not necessarily relevant display message coupling with corresponding element.For example, graphic icons can be used for Alternative digital, the selection of being undertaken by positioning equipment and can be logical operation with the hidden algorithm of selecting sequence to combine, and it can combine the information that provides in the mode of logic with one or more icons.
Equally, when single array can be used to realize when of the present invention, the use of subarray provides the prompting of another grade to the user, because four subarrays that illustrate can present with any arrangement on screen 24A-D.The user determines suitable subarray 24A-D for each element, and the user is by the clue unique to each subarray 24A-D, and for example, the value (for example, numeral) of unique color framework around each subarray or the color that shows on each element 26 is imported.Screen 20 also comprises the zone 20,21 that is used to import the user name and password, usually as existence such as logon screens.But, input area is not of the presently claimed invention, screen 20 can comprise separately that prompting shows 23, especially when all values of input all has the corresponding element that is presented on the screen 20, in this case, for example the positioning equipment of mouse or touch-screen can be used for realizing receiving the input equipment of sequence of tokens.If the user is previously known identification, if pattern/algorithm is that all users are shared, if perhaps can accept more loose security scheme, wherein, by mating permission and using a plurality of tokens to discern the user, User Recognition zone 20 is unnecessary so.
Can generate the element 26 of subarray 24A-D at random with quasi-random ground, be used for array is carried out initialization.If like this, the pattern of element 26 is used for selecting sequential value from the element 26 corresponding to the known correct element sequence of user.Alternately, can the generting element sequence, in pattern position " generation ", then, " uncorrelated " value that other generate at random can be filled in the position of other elements 26 among the subarray 24A-D.If prompting shows that 23 are divided into subarray, sequence also is necessary for the appropriate location in the correct subarray of each element consideration so.For example, if subarray 24A-D is by painted separately: { red, blue, yellow, green }, the known suitable element sequence of user is a highest delegation redness, the middle row blueness, prompting shown in the basis shows 23 sequence so, from left to right reading this row, is 8,7,3,5,4,2 successively.
The next part of the security mechanisms that the present invention realizes is the combination that utilizes the sequential value of hidden algorithm (opposite with above-mentioned visible pattern).Selected sequence is then carried out computing by at least one operational symbol at least one computing.Operational symbol can be a mathematical operator, for example, add, subtract, take advantage of and remove, and produce element value be equal to (or " duplicating " or " repetition ") operational symbol, perhaps for example " less than " or " greater than " relational operator, can or only carry out computing in some cases to two or more elements to an element.Not every computing all is that identity of operation or algorithm are not the sequences above also only the disclosing of hiding, although system can be embodied as the selection scheme with lower-security grade with " non-hiding " algorithm extraly according to an embodiment of the invention.Be one in each element in the pattern, provide non-hidden algorithm, make the output of algorithm be equal to list entries by identity of operation symbol sequence.Also can adopt and hide constant, for example " each numeral be added 1 " or " if>4, input digit " and similar other rules in conjunction with above-mentioned operational symbol.
As the example of relational calculus, utilize above-mentioned example as sequence, algorithm can return the least member in every row, and in this case, suitable token input can be 3,2.In another example, algorithm can increase preceding two elements of this row for first value, and is that second value is used element, and in this case, correct token is 15,3,9,2.Operations/algorithms also can be extended in subarray.For example, algorithm can with each element in first subarray successively with second subarray in each element multiply each other, and with the result as the token character string.Upward suitable token is 40,28,6 in the routine sequence.
Shown in example, according to the relative complexity that the prompting that can become arbitrarily big shows, have arbitrarily element value on a large scale equally and the complicacy of the algorithm that adopted, the present invention can realize very complicated and strong mechanism.Usually, be convenient to be remembered and the safety grades that provided by particular combinations directly averages out between the two at pattern and algorithm.
With reference now to Fig. 3,, the process flow diagram that illustrates according to the embodiments of the invention method has been described.Can be by in computing equipment, for example personal computer, workstation or as the special-purpose terminal of ATM, the programmed instruction of execution is realized described method.Programmed instruction can be realized in the computer program product of the medium that comprises the described programmed instruction of encoding.Utilize random number generator (step 30) to generate prompting and show, and display reminding shows (step 31).Then, by user ID input area 20 identification users, from memory search user pattern and algorithm (step 32).Then, show collection sequential value (step 33) according to predetermined pattern element from prompting.Then, utilize the value computational token (step 34) of collecting according to pre-defined algorithm.When user's input digit sequence (step 35), the token value of calculating in sequence and the step 33 is compared, if list entries coupling (determining 36) so, is authorized resource to protection conduct interviews (step 37).
According to another embodiment of the invention, also be provided for the control panel of placement algorithm and pattern, and can realize with figure or text mode.The figure control panel usually allows to select pattern sequence by positioning equipment, and with the combination or the single value of regular allocation value of element in the pattern.The text control panel can, for example by utilizing matrix position accept to describe the character string of pattern and algorithm as index, each element can be by Position Number by unique identification.Operational symbol can be endowed their symbol, and for example, " R " expression is duplicated, "+" expression summation, and " X " expression is multiplied each other, " S " expression " less than " or the like.For character string is encoded, can will be attached in the matrix with the tactic any subarray of subarray " original ".
For example, if the Position Number inter-bank is from left to right distributed, and in showing, prompting descends, so above-mentioned exemplary algorithm with each element of first subarray successively with second subarray in each element multiply each other, and with the result as the token character string, can be encoded as " E1XE25; E2XE26; E3XE27 ", wherein, X is " multiplying each other " operational symbol.(as used in last example, element 25-27 is corresponding to the middle row of subarray 24B.)
When the present invention is specifically illustrated and is described in conjunction with the preferred embodiments, it will be appreciated by those skilled in the art that under the situation that does not deviate from the spirit and scope of the present invention and can carry out above-mentioned and other change form of the present invention and details.